freeipa

#5739 [RFE] support installation into isolated network (no Internet access)
Closed: wontfix by cheimes. Opened by cheimes.

Closed: wontfix
Reopen Issue

I'm not able to install a FreeIPA server with reverse zone in an isolated network. FreeIPA always tries to contact an upstream DNS server to look up the reverse zone. For forward zones, FreeIPA uses raise_on_error=False for check_zone_overlap() and ignores connection error exceptions.

# ipa-server-install -U --realm IPA.EXAMPLE --domain ipa.example --hostname master.ipa.example --ds-password Secret123 --admin-password Secret123 --ip-address 192.168.121.131 --setup-dns --reverse-zone=121.168.192.in-addr.arpa. --no-forwarders
Usage: ipa-server-install [options]
ipa-server-install: error: option --reverse-zone: DNS check for domain 121.168.192.in-addr.arpa. failed: All nameservers failed to answer the query 121.168.192.in-addr.arpa. IN SOA: Server 192.168.121.1 UDP port 53 anwered REFUSED.
ipa.ipapython.install.cli.install_tool(Server): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

https://git.fedorahosted.org/cgit/freeipa.git/tree/ipaserver/install/dns.py#n121

https://git.fedorahosted.org/cgit/freeipa.git/tree/ipaserver/install/dns.py#n132

I'll let Petr Spacek to assess this ticket. But a possible workaround is to pass --allow-zone-overlap option.

I would like to see debug output/log and also output from command dig @192.168.121.1 121.168.192.in-addr.arpa. SOA.

Thank you.

Here you are:

[root@master /]# ipa --version
VERSION: 4.3.0, API_VERSION: 2.163
[root@master /]# ip route
default via 192.168.121.1 dev ens5 
192.168.121.0/24 dev ens5  proto kernel  scope link  src 192.168.121.186  metric 100 
[root@master /]# dig @192.168.121.1 121.168.192.in-addr.arpa. SOA
; <<>> DiG 9.10.3-P3-RedHat-9.10.3-10.P3.fc23 <<>> @192.168.121.1 121.168.192.in-addr.arpa. SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 12659
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;121.168.192.in-addr.arpa.      IN      SOA
;; Query time: 0 msec
;; SERVER: 192.168.121.1#53(192.168.121.1)
;; WHEN: Mon Mar 21 11:46:51 UTC 2016
;; MSG SIZE  rcvd: 42
[root@master /]# host www.freeipa.org
Host www.freeipa.org not found: 5(REFUSED)
2016-03-21T11:45:55Z DEBUG Logging to /var/log/ipaserver-install.log
2016-03-21T11:45:55Z INFO Checking DNS domain 121.168.192.in-addr.arpa., please wait ...
2016-03-21T11:46:25Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 309, in run
    self.option_parser.error("{0}: {1}".format(desc, e))
  File "/usr/lib64/python2.7/optparse.py", line 1584, in error
    self.exit(2, "%s: error: %s\n" % (self.get_prog_name(), msg))
  File "/usr/lib64/python2.7/optparse.py", line 1574, in exit
    sys.exit(status)
2016-03-21T11:46:25Z DEBUG The ipa-server-install command failed, exception: SystemExit: 2
2016-03-21T11:46:25Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

PS: It's a 4.3 regression. 4.2.3 installs fine.

Interesting. What DNS server is running on 192.168.121.1 and how is it configured? I'm still not convinced that this is a valid configuration because resolv.conf should point to a fully working recursive resolver.

In this case 192.168.121.1 is a libvirt network in isolated mode. The machines are able to talk to each other but cannot communicate outside the virtual network. There is no DNS server listening on 192.168.121.1:53, too. Basically it's an offline installation with all ethernet cables pulled out of the (virtual) machine.

Please note that the installer is run with {{{--no-forwarders}}} option.

First of all, dig's output indicates that there is something listening on 192.168.121.1:53. The thing replies with REFUSED error code.

--no-forwarders option enables full recursion as explained on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/managing-dns-forwarding.html .

Setup in really isolated networks was not tested/really supported so I'm going to change this ticket into RFE: support IPA installation in isolated networks.

dev mtg: test if --force option works. If so then close otherwise fix.. 
--allow-zone-overlap should work?

4.3.2 was released, moving to 4.3.3

Metadata Update from @cheimes:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.3.3

4.3.x EOL

Metadata Update from @mbasti:
- Issue close_status updated to: None
- Issue set to the milestone: FreeIPA 4.4.5 (was: FreeIPA 4.3.3)

Metadata Update from @cheimes:
- Issue priority set to: minor (was: normal)
- Issue set to the milestone: FreeIPA 4.8 (was: FreeIPA 4.4.5)

Metadata Update from @cheimes:
- Assignee reset

Closing. I don't need this fix any more. Nobody else has reported a similar issue in almost three years.

Metadata Update from @cheimes:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Highest
enhancement
DNS
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.